PT-2013-1526 · Oracle · Javafx

Published 2013-02-02 · Updated 2017-09-19 · CVE-2012-1543

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Java SE JavaFX version 2.2.4 and earlier

Description The issue affects confidentiality, integrity, and availability. It is reportedly due to an invalid type cast in the JSObject class, although Oracle has not commented on this claim. The vulnerability can be exploited by remote attackers via unknown vectors.

Recommendations For Oracle Java SE JavaFX version 2.2.4 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2012-1543

ZDI-13-012

ZDI-13-013

Affected Products

Javafx

References · 9

• https://zerodayinitiative.com/advisories/ZDI-13-012 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-13-013 · Security Note
• http://oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=136733161405818&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1543 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16673 · Note
• http://kb.cert.org/vuls/id/858729 · Note
• http://verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1026 · Note
• http://us-cert.gov/cas/techalerts/TA13-032A.html · Note